Caddy: V2: Cannot use multiple tls directives with cert files

[gilbsgilbs]

Hi,

I'm trying to use multiple tls directives with cert files in a Caddyfile, but it looks like Caddy only considers the last tls directive declared.

https://domain0.localhost {
  tls ./domain0.crt ./domain0.key
  respond "domain0"
}

https://domain1.localhost {
  tls ./domain1.crt ./domain1.key
  respond "domain1"
}

With this Caddyfile, domain1.localhost works as expected, but Caddy is unable to initiate the TLS connection on domain0.localhost:

$ curl -v -k https://domain0.localhost
*   Trying ::1:443...
* TCP_NODELAY set
* Connected to domain0.localhost (::1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, internal error (592):
* error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
* Closing connection 0
curl: (35) error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error

Relevant caddy log:

http: TLS handshake error from [::1]:59928: no certificate available for 'domain0.localhost'

Notes:

• Commenting out one of the virtual hosts make the uncommented one work as expected, meaning that it's not a problem with the certificates
• Same issue occurs when using the same certificate for both virtual hosts (for instance a wildcard certificate on *.localhost, but still two tls directives)

Here is a repro with a Caddyfile, a fake CA and two fake certificates signed by the fake CA: caddy_tls.zip.

$ ./caddy version  
v2.0.0-beta.14 h1:QX1hRMfTA5sel53o5SuON1ys50at6yuSAnPr56sLeK8=

$ uname -a 
Linux buks 5.5.5-arch1-1 #1 SMP PREEMPT Thu, 20 Feb 2020 18:23:09 +0000 x86_64 GNU/Linux

$ lsb_release -a
LSB Version:    1.4
Distributor ID: Arch
Description:    Arch Linux
Release:    rolling
Codename:   n/a

Tell me if you need more details.

Thanks.

[francislavoie]

Do you mind trying to build from the latest commit on the v2 branch? I think there have been some relevant fixes in the past few days.

I think either 0b09b070 or 0005e3ac or 99f91c4c have fixed it.

[gilbsgilbs]

Definitely should have tested before submitting an issue, 100% my fault I'm sorry for the noise. This is indeed fixed on v2 branch. Congrats for fixing an issue 7 days before I had it, very good performance as usual :clap: .

[francislavoie]

No worries at all, the bug was reported at the end of https://github.com/caddyserver/caddy/issues/3004 after it was closed, so it wasn't tracked in an obvious way. :smile:

[mholt]

Thank you for the detailed report nonetheless, complete with certs to test with! Would have made it very easy too :)